Skip to content

Commit 355ef85

Browse files
atiillaatiilla
committed
follow the white rabbit
0 parents  commit 355ef85

29 files changed

+2829
-0
lines changed

‎.dockerignore‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Python
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
*.so
6+
.Python
7+
venv/
8+
env/
9+
ENV/
10+
.env
11+
.venv
12+
.eggs/
13+
*.egg-info/
14+
15+
# Development
16+
.git
17+
.github
18+
.vscode
19+
.idea
20+
21+
# Build artifacts
22+
dist/
23+
build/
24+
*.log

‎.github/README.md‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
# GitHub Actions & Dependabot Configuration
2+
3+
This directory contains GitHub Actions workflows and Dependabot configuration for the WhiteRabbitMCP project.
4+
5+
## Files Overview
6+
7+
### 🤖 `dependabot.yml`
8+
Configures Dependabot to automatically create pull requests for dependency updates:
9+
10+
- **Python dependencies**: Weekly updates on Mondays at 9:00 AM
11+
- **Docker dependencies**: Weekly updates on Mondays at 9:30 AM
12+
- **GitHub Actions**: Weekly updates on Mondays at 10:00 AM
13+
14+
**Auto-merge Configuration:**
15+
- Patch updates are allowed for auto-merge
16+
- Development dependencies can auto-merge minor updates
17+
- Major updates require manual review
18+
19+
### 🔄 `dependabot-auto-merge.yml`
20+
Automatically merges Dependabot PRs that meet safety criteria:
21+
22+
**Auto-merge Conditions:**
23+
- ✅ Patch updates (e.g., 1.0.1 → 1.0.2)
24+
- ✅ Minor updates for dev dependencies (e.g., 1.0.0 → 1.1.0)
25+
- ❌ Major updates require manual review (e.g., 1.0.0 → 2.0.0)
26+
27+
**Safety Checks:**
28+
- Python import tests
29+
- Toolkit module validation
30+
- Docker build verification
31+
- Basic functionality tests
32+
33+
### 🔒 `security-checks.yml`
34+
Comprehensive security and quality analysis:
35+
36+
**Security Tools:**
37+
- **Safety**: Checks for known vulnerabilities in Python dependencies
38+
- **Bandit**: Static security analysis for Python code
39+
- **Trivy**: Container and filesystem vulnerability scanning
40+
- **Secret Detection**: Scans for hardcoded secrets and API keys
41+
42+
**Container Security:**
43+
- Validates Docker build process
44+
- Checks container user permissions
45+
- Scans for security misconfigurations
46+
47+
### 🧪 `ci.yml`
48+
Continuous integration pipeline:
49+
50+
**Test Matrix:**
51+
- Python versions: 3.10, 3.11, 3.12
52+
- Cross-platform compatibility testing
53+
54+
**Quality Checks:**
55+
- Code linting with flake8
56+
- Import validation
57+
- Docker build verification
58+
- Security scanning with Trivy
59+
60+
## How Auto-merge Works
61+
62+
1. **Dependabot creates a PR** for dependency updates
63+
2. **CI pipeline runs** basic tests and security checks
64+
3. **Auto-merge workflow evaluates** the update type:
65+
- **Patch updates**: Auto-merged after tests pass
66+
- **Minor dev updates**: Auto-merged after tests pass
67+
- **Major updates**: Flagged for manual review
68+
4. **Labels are applied** based on update severity
69+
5. **Comments are added** for major updates requiring attention
70+
71+
## Security Features
72+
73+
### 🛡️ Multi-layer Security
74+
- Dependency vulnerability scanning
75+
- Static code analysis
76+
- Container security validation
77+
- Secret detection
78+
- Supply chain security monitoring
79+
80+
### 🏷️ Automated Labeling
81+
- `patch-update, auto-mergeable`: Safe for auto-merge
82+
- `minor-update`: Minor changes, may auto-merge
83+
- `major-update, needs-review`: Requires manual review
84+
85+
### 📊 Reporting
86+
- Security scan results uploaded as artifacts
87+
- SARIF reports integrated with GitHub Security tab
88+
- Detailed logs for all security checks
89+
90+
## Configuration Customization
91+
92+
### Adjusting Auto-merge Rules
93+
Edit `.github/workflows/dependabot-auto-merge.yml`:
94+
95+
```yaml
96+
# Example: Allow minor updates for production dependencies
97+
- name: Auto-merge minor updates for production
98+
if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-minor' && steps.metadata.outputs.dependency-type == 'direct:production' }}
99+
```
100+
101+
### Modifying Dependabot Schedule
102+
Edit `.github/dependabot.yml`:
103+
104+
```yaml
105+
schedule:
106+
interval: "daily" # Options: daily, weekly, monthly
107+
time: "06:00" # UTC time
108+
day: "sunday" # For weekly interval
109+
```
110+
111+
### Adding Custom Security Checks
112+
Edit `.github/workflows/security-checks.yml`:
113+
114+
```yaml
115+
- name: Custom security check
116+
run: |
117+
# Add your custom security validation here
118+
echo "Running custom security checks..."
119+
```
120+
121+
## Permissions Required
122+
123+
The workflows require the following GitHub token permissions:
124+
125+
```yaml
126+
permissions:
127+
contents: write # For auto-merging PRs
128+
pull-requests: write # For PR management
129+
security-events: write # For security reporting
130+
checks: read # For status checks
131+
actions: read # For workflow access
132+
```
133+
134+
## Monitoring & Maintenance
135+
136+
### 📈 Metrics to Monitor
137+
- Auto-merge success rate
138+
- Security scan findings
139+
- Dependency update frequency
140+
- Build failure rates
141+
142+
### 🔧 Regular Maintenance
143+
- Review security scan results weekly
144+
- Update workflow dependencies monthly
145+
- Audit auto-merge rules quarterly
146+
- Review and update security policies
147+
148+
## Troubleshooting
149+
150+
### Auto-merge Not Working
151+
1. Check if branch protection rules allow auto-merge
152+
2. Verify GitHub token permissions
153+
3. Review workflow logs for errors
154+
4. Ensure all required status checks pass
155+
156+
### Security Scans Failing
157+
1. Review security scan artifacts
158+
2. Check for new vulnerabilities in dependencies
159+
3. Update security scanning tools
160+
4. Review and fix any security issues found
161+
162+
### False Positives
163+
1. Add exceptions to security scanning tools
164+
2. Update scanning configurations
165+
3. Document known false positives
166+
4. Consider allowlisting specific findings
167+
168+
## Best Practices
169+
170+
✅ **Do:**
171+
- Review major updates manually
172+
- Monitor security scan results
173+
- Keep workflow dependencies updated
174+
- Test auto-merge rules in staging
175+
176+
❌ **Don't:**
177+
- Auto-merge major version updates
178+
- Ignore security scan findings
179+
- Disable security checks for speed
180+
- Skip manual review of critical dependencies

‎.github/dependabot.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for Python dependencies
4+
- package-ecosystem: "pip"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 10
11+
target-branch: "main"
12+
reviewers:
13+
- "atiilla"
14+
assignees:
15+
- "atiilla"
16+
labels:
17+
- "dependencies"
18+
- "python"
19+
commit-message:
20+
prefix: "deps"
21+
prefix-development: "deps-dev"
22+
include: "scope"
23+
# Auto-merge configuration
24+
allow:
25+
- dependency-type: "direct:production"
26+
update-type: "version-update:semver-patch"
27+
- dependency-type: "direct:development"
28+
update-type: "version-update:semver-patch"
29+
- dependency-type: "indirect"
30+
update-type: "version-update:semver-patch"
31+
32+
# Enable version updates for Docker
33+
- package-ecosystem: "docker"
34+
directory: "/"
35+
schedule:
36+
interval: "weekly"
37+
day: "monday"
38+
time: "09:30"
39+
open-pull-requests-limit: 5
40+
target-branch: "main"
41+
reviewers:
42+
- "atiilla"
43+
assignees:
44+
- "atiilla"
45+
labels:
46+
- "dependencies"
47+
- "docker"
48+
commit-message:
49+
prefix: "deps"
50+
include: "scope"
51+
52+
# Enable version updates for GitHub Actions
53+
- package-ecosystem: "github-actions"
54+
directory: "/"
55+
schedule:
56+
interval: "weekly"
57+
day: "monday"
58+
time: "10:00"
59+
open-pull-requests-limit: 5
60+
target-branch: "main"
61+
reviewers:
62+
- "atiilla"
63+
assignees:
64+
- "atiilla"
65+
labels:
66+
- "dependencies"
67+
- "github-actions"
68+
commit-message:
69+
prefix: "deps"
70+
include: "scope"

‎.github/workflows/ci.yml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
test:
14+
runs-on: ubuntu-latest
15+
strategy:
16+
matrix:
17+
python-version: ['3.10', '3.11', '3.12']
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
23+
- name: Set up Python ${{ matrix.python-version }}
24+
uses: actions/setup-python@v5
25+
with:
26+
python-version: ${{ matrix.python-version }}
27+
cache: 'pip'
28+
29+
- name: Install dependencies
30+
run: |
31+
python -m pip install --upgrade pip
32+
pip install -r requirements.txt
33+
34+
- name: Lint with flake8
35+
run: |
36+
pip install flake8
37+
# Stop the build if there are Python syntax errors or undefined names
38+
flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
39+
# Exit-zero treats all errors as warnings
40+
flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
41+
42+
- name: Test imports
43+
run: |
44+
# Test server import
45+
python -c "import server; print('✅ Server imported successfully')"
46+
47+
# Test toolkit imports
48+
python -c "
49+
import sys
50+
import os
51+
sys.path.append('toolkit')
52+
53+
modules = ['nmap', 'holehe', 'sherlock', 'sqlmap', 'sublist3r', 'dnsrecon', 'wpscan', 'zmap', 'ocr2text']
54+
for module in modules:
55+
try:
56+
__import__(module)
57+
print(f'✅ {module} imported successfully')
58+
except ImportError as e:
59+
print(f'❌ {module} import failed: {e}')
60+
raise
61+
"
62+
63+
docker:
64+
runs-on: ubuntu-latest
65+
steps:
66+
- name: Checkout code
67+
uses: actions/checkout@v4
68+
69+
- name: Build Docker image
70+
run: |
71+
docker build -t whiterabbitmcp:test .
72+
73+
- name: Test Docker container
74+
run: |
75+
# Test that the container starts without errors
76+
docker run --rm whiterabbitmcp:test python -c "
77+
import server
78+
print('✅ Docker container test passed')
79+
"
80+
81+
security:
82+
runs-on: ubuntu-latest
83+
steps:
84+
- name: Checkout code
85+
uses: actions/checkout@v4
86+
87+
- name: Run Trivy vulnerability scanner
88+
uses: aquasecurity/trivy-action@master
89+
with:
90+
scan-type: 'fs'
91+
scan-ref: '.'
92+
format: 'sarif'
93+
output: 'trivy-results.sarif'
94+
95+
- name: Upload Trivy scan results
96+
uses: github/codeql-action/upload-sarif@v3
97+
if: always()
98+
with:
99+
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)